Change FAST Search user (FAST Search Server 2010 for SharePoint)

Applies to: FAST Search Server 2010

If you want to change the user that FAST Search Server 2010 for SharePoint is running under, follow these steps:

1. Stop FAST Search Server 2010 for SharePoint on all servers in the farm.

2. On each server in the FAST Search Server 2010 for SharePoint farm, starting with the administration server:

   Note

   First, follow these steps on the administration server. Then, restart the administration server before repeating the steps for the other servers in the deployment.

   1. Add the new FAST Search user to the local FASTSearchAdministrators group. Remove the old FAST Search user.

   2. Update the user credentials for all FAST Search Server 2010 for SharePoint Windows Services:

      • FASTSearchService

      • FASTSearchBrowserEngine

      • FASTSearchMonitoring

      • QRProxyService

      • FASTSearchSAMAdmin

      • FASTSearchSAMWorker

   3. Open a Microsoft FAST Search Server 2010 for SharePoint shell as an administrator:

      1. On the Start menu, click All Programs.

      2. Click Microsoft FAST Search Server 2010 for SharePoint.

      3. Right click Microsoft FAST Search Server 2010 for SharePoint shell and select Run as administrator.

   4. Set the Local Security Authority (LSA) policy for the new FAST Search user:

      At the command prompt, type the following command(s):

      Set-LsaPolicy -AccountName <domain\user> -Privilege "SeServiceLogonRight"
      Set-LsaPolicy -AccountName <domain\user> -Privilege "SeAssignPrimaryTokenPrivilege"
      Set-LsaPolicy -AccountName <domain\user> -Privilege "SeIncreaseQuotaPrivilege"
      

      Where:

      • <domain\user> is the new FAST Search user.

   5. Set a new discretionary access control list (DACL) on ports:

      At the command prompt, type the following command(s):

      Set-Services -UserName <domain\user> -BasePort <baseport>
      

      Where:

      • <domain\user> is the new FAST Search user.

      • <baseport> is the base port value in etc\hostconfiguration.xml.

   6. Grant permission to the new FAST Search user to stop and start services:

      At the command prompt, navigate to the bin directory under the installation folder and type the following command(s):

      .\ServiceAccessControl.exe FASTSearchMonitoring <domain\user>
      .\ServiceAccessControl.exe FASTSearchSAMWorker <domain\user>
      .\ServiceAccessControl.exe FASTSearchSAMAdmin <domain\user>
      .\ServiceAccessControl.exe QRProxyService <domain\user>
      .\ServiceAccessControl.exe FASTSearchBrowserEngine <domain\user>
      

      Where:

      • <domain\user> is the new FAST Search user.

   7. Update the reference to the user name in etc\hostconfiguration.xml.

   8. Recreate the configuration files:

      At the Windows PowerShell command prompt, type the following command(s):

      Set-FASTSearchConfiguration
      

   9. Make sure that the new user has access to the certificates and the corresponding private keys that are used by FAST Search Server 2010 for SharePoint. Refer to Manage certificates (FAST Search Server 2010 for SharePoint) for more information.

   10. Grant the new user full access to the FAST Search Server 2010 for SharePoint installation folder. Remove the old FAST Search user from the security description for the installation folder.

3. On the administration server in the FAST Search Server 2010 for SharePoint farm, perform the following additional steps:

   1. In Internet Information Services (IIS), change the user who runs the application pool FASTSearchApplicationPool.

   2. Restart the application pool.

   3. In the params.xml file, under \etc\config_data\deployment\, update the user name value to reflect the new user.

4. Update the Query SSA on SharePoint Server.

   1. From the SharePoint Server Central Administration home page, select Application Management > Manage Service Applications. In the list of Service Applications, highlight the name of your Query SSA. Click Properties.

   2. Update the Account for Administration Service field.

   3. Make sure that the security account selected for running the application pool for Search Admin Web Service is a member of the FASTSearchAdministrators group on the FAST Search Server 2010 for SharePoint administration server.

5. Make sure that the new FAST Search user has read and write access to the SQL Server.

6. Restart all servers in the FAST Search Server 2010 for SharePoint farm.